This vulnerability, tracked as CVE-2026-45486, involves a use-after-free condition (CWE-416) in Microsoft Office Word component of Microsoft 365 Apps for Enterprise. It arises from an untrusted pointer dereference that could allow an unauthorized attacker to execute code locally on the affected system. The CVSS v3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits in the wild have been reported at this time.

Successful exploitation of this vulnerability could allow an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability affects Microsoft 365 Apps for Enterprise users running version 16.0.1. Because it is a use-after-free flaw, it may lead to memory corruption and code execution.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45486 to ensure their Microsoft 365 Apps for Enterprise environment is updated and protected against this vulnerability.